Aflac Reports Cyber Incident Impacted 22.6 Individuals Earlier This Year

Aflac recently revealed that a cybersecurity incident that occurred six months ago impacted more than 22.6 million individuals. The health and life insurer, headquartered in Columbus, Georgia, stated that it has initiated the process of notifying those affected. Fortunately, there has been no indication of fraudulent activity involving personally identifiable information so far, and Aflac continues to monitor the situation closely. The discovery was made on December 4, prompting Aflac to begin informing individuals whose personal information may have been potentially compromised.

Back in June, Aflac announced its investigation into a breach on its U.S. network that led to potential exposure of customers’ personal data. The cyberattack, believed to be the work of the cybercrime group Scattered Spider, was first identified on June 12. Following Aflac’s announcement, the Google Threat Intelligence Group issued an advisory indicating that Scattered Spider had shifted focus from retailers to insurers. Subsequently, Erie Insurance and Philadelphia Insurance experienced network outages. Erie Insurance later confirmed full restoration of business operations without any evidence of a data breach, while Philadelphia Insurance reported network recovery with no indication of a ransomware incident.

In response to the incident, Aflac promptly launched an investigation with the assistance of third-party cybersecurity experts and notified federal authorities. The breach impacted Aflac’s customers, beneficiaries, employees, agents, and other related individuals. Potentially compromised data included names, contact information, claims details, health information, social security numbers, and other personal details. Fortunately, Aflac was able to contain the security breach within hours, ensuring that their systems remained operational without being affected by ransomware.

Interestingly, around the same time, Aflac faced a proposed class-action lawsuit in Georgia federal court, which is currently ongoing. Erie Insurance also found itself battling two class-action lawsuits related to the cyber incident. Despite these legal challenges, Aflac reassured the public of their commitment to cybersecurity by swiftly responding to the breach and taking necessary precautions to protect the affected individuals.

In conclusion, Aflac’s disclosure of the cybersecurity incident serves as a reminder of the persistent threat of cyberattacks faced by companies across various industries. The incident underscores the importance of robust cybersecurity measures and proactive response strategies to mitigate the risks associated with data breaches. Moving forward, organizations must prioritize cybersecurity to safeguard sensitive information and maintain trust among their stakeholders in an increasingly digital world.